CVE-2026-52883: MantisBT Vulnerability Allows Injection of TIME_TRACKING and REMINDER Notes via APIs
Summary
CVE-2026-52883: MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs. Affects mantisbt/mantisbt versions < 2.28.4. Fixed in 2.28.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source issue tracker designed for managing software development projects. It provides features such as bug tracking, project management, and reporting tools. The software is widely used by development teams to streamline their workflow and improve collaboration. However, a recent vulnerability has been identified that allows unauthorized users to inject specific types of notes into the system, potentially compromising the integrity of billing and project management data.
Vulnerability Detail
The vulnerability arises from an unvalidated 'note_type' parameter in the mc_issue_update SOAP endpoint. This flaw allows attackers with UPDATER access to create TIME_TRACKING and REMINDER notes without proper authorization. Specifically, if a user's access level exceeds the defined threshold for viewing time tracking data, they can inject arbitrary hours into billing reports, leading to incorrect invoicing and corrupt project management decisions. The REST API also permits the injection of TIME_TRACKING notes through the same mc_issue_update() function, although REMINDER notes cannot be injected via this method.
How To Fix
Minimum fixed version
2.28.4
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.28.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds available to mitigate this vulnerability. The best course of action is to apply the patch by updating to the latest version of MantisBT.
Conclusion
In summary, CVE-2026-52883 presents a significant risk to MantisBT users, allowing unauthorized note injection that can compromise billing and project management data. It is crucial to update to the patched version to secure your application against this vulnerability.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
CVE-2026-52883 is a vulnerability in MantisBT that allows unauthorized injection of TIME_TRACKING and REMINDER notes via its APIs.
If exploited, this vulnerability can lead to the injection of false billing hours, resulting in incorrect invoices and potentially damaging project management decisions.
Versions of MantisBT up to and including 2.28.3 are affected by this vulnerability.
Yes, a patch is available in version 2.28.4 of MantisBT. Users are advised to update to this version to mitigate the vulnerability.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your composer.lock file or using the Vulert playground, you can check for vulnerabilities without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
